BS11: OUTSOURCING POLICY

Transcription

1 BS11: OUTSOURCING POLICY Purpose of document This document sets out the Reserve Bank s policy for outsourcing by banks. Prudential Supervision Department Document BS11

2 Document version history 2 January 2006 September 2017 First issue date Revised Legal powers Section 74 of the Reserve Bank of New Zealand Act 1989 (the Act) permits the Reserve Bank of New Zealand (the Reserve Bank) to impose conditions of registration on any bank relating to, among other things, the matters referred to in sections 78(1)(e), (1)(fa) and (1)(fb) of the Act. All of the material set out in this document that imposes requirements on banks forms part of the requirements referred to in the condition, except material that is identified as guidance by being included in a shaded box like this.

3 3 BS11: OUTSOURCING POLICY Part A: Introduction Part B: General requirements on banks Part C: Reserve Bank lists Part D: Transitional arrangements Appendix one: Conditions of registration Part A: Introduction A1 A2 Overview of outsourcing policy Contents A1.1 Purpose and structure of document A1.2 Objectives of outsourcing policy A1.3 Application of outsourcing policy A1.4 Legal powers A1.5 Reserve Bank action following non-compliance Interpretation A2.1 Meaning of words and phrases Part B: General requirements on banks B1 B2 Outcomes B1.1 Obligation of individual bank to achieve outcomes B1.2 Obligation of bank that is part of a foreign-owned banking group to achieve outcomes Risk mitigation B2.1 Outsourcing arrangements to include risk mitigation provisions B2.2 Outsourcing arrangement with independent third party B2.3 Outsourcing arrangement with subsidiary B2.4 Outsourcing arrangement made through subsidiary B2.5 Outsourcing arrangement with other related party B2.6 Outsourcing arrangement made through parent or other related party B2.7 Other outsourcing arrangement B2.8 Outsourcing arrangement with other related party: robust back-up and alternative arrangements B2.9 Prescribed contractual terms

4 B3 B4 B5 Non-objection from Reserve Bank 4 B3.1 Non-objection required for certain outsourcing arrangements B3.2 Application for non-objection B3.3 Consideration of application B3.4 Existing outsourcing arrangements and in-progress outsourcing arrangements Compendium B4.1 Requirement for, and purpose of, compendium B4.2 Content and form of compendium B4.3 Bank must maintain, and annually review, compendium B4.4 Bank must provide compendium to Reserve Bank B4.5 Transitional provision Separation plan B5.1 Requirement for, and purpose of, separation plan B5.2 Content and form of separation plan B5.3 Non-objection required for separation plan B5.4 Application for non-objection B5.5 Consideration of application B5.6 Bank to test separation plan annually B5.7 Reporting of changes to, and review of, separation plan Part C: Reserve Bank lists C1 C2 Pre-approved functions and services C1.1 Reserve Bank may maintain List of Pre-approved Services and Functions C1.2 Amendments to List of Pre-approved Services and Functions Exempt functions and services C2.1 Reserve Bank may maintain list of exempt services and functions C2.2 Amendments to the White List Part D: Transitional arrangements D1 D2 Path to compliance and external review D1.1 5-year transition period D1.2 Annual external review during 5-year transition period D1.3 Appointment of external reviewer Reviews after 5-year transition period D2.1 3-yearly reviews D2.2 Appointment of external reviewer Appendix one: Conditions of registration 1 Conditions of registration 1.1 Conditions of registration 1.2 Application of conditions of registration *****

5 5 Part A: Introduction A1 Overview of outsourcing policy A1.1 Purpose and structure of document (1) This document sets out the Reserve Bank s policy for outsourcing by banks. (2) This Part sets out the objectives of the policy; and describes the banks to which the policy will apply; and specifies the underlying legal powers; and (d) specifies how the Reserve Bank will treat non-compliance; and (e) defines words and phrases that are used within the policy. (3) Part B sets out the outcomes of the policy; and the risk mitigation requirements banks are required to have; and the process for non-objection; and (d) the requirements for a compendium; and (e) the requirements for a separation plan. (4) Part C sets out the list of Pre-approved Services and Functions; and the white list. (5) Part D sets out the transition path requirements; and the external review requirements. (6) Appendix one sets out the conditions of registration. A1.2 Objectives of outsourcing policy The objectives of this policy are to ensure that an outsourcing arrangement entered into by a bank does not compromise that bank s ability to be effectively administered under statutory management; and operated for the purposes of continuing to provide and circulate liquidity to the financial system and the wider economy; and facilitate the carrying on of basic banking services by any new owner of all or part of the bank; and address the impact that the failure of a service or function provider may have on the bank s ability to carry on all or part of the business of the bank.

6 6 A1.3 Application of outsourcing policy (1) A large bank will be required, under its conditions of registration, to comply with this policy. (2) The following banks may also be required, under their conditions of registration, to comply with all or part of this policy: a bank that becomes a large bank; a bank that was a large bank, but which no longer falls within the definition of a large bank. A1.4 Legal powers (1) Under Part 5 of the Act the Reserve Bank registers banks, is required to prudentially supervise them and is provided with the powers to do so. (2) Section 68 of the Act requires the powers under Part 5 of the Act to be exercised for the purposes of promoting the maintenance of a sound and efficient financial system; or avoiding significant damage to the financial system that could result from the failure of a registered bank. (3) Section 68A of the Act requires that the Reserve Bank, when exercising its Part 5 powers, must support Australian authorities in pursuit of Australian financial stability; and where reasonably practicable, avoid actions that are likely to have a detrimental effect on financial stability in Australia. (4) Section 74 of the Act permits the Reserve Bank to impose conditions of registration on banks which, among other things, may include conditions that relate to the matters referred to in section 78(1)(e), (1)(f), and (1)(fb) of the Act, namely the separation of the business or proposed business from other business and from other interest of any person owning or controlling the applicant or registered bank (section 78(1)(e)); and the internal controls and accounting systems or proposed internal controls and accounting systems (section 78(1)(f)); and the arrangements for any business, or functions relating to any business, of the applicant or registered bank to be carried on by any person other than the applicant or the registered bank (section 78(1)(fb)). (5) The standard conditions of registration for banks subject to the outsourcing policy are set out in Appendix one. A1.5 Reserve Bank action following non-compliance (1) If any outsourcing arrangement entered into by a bank fails to comply with the requirements of BS11, the Reserve Bank will require the bank to amend the terms of the relevant outsourcing arrangement to achieve compliance. (2) However, if the bank fails to achieve compliance, the Reserve Bank may take enforcement action against the bank to ensure compliance.

7 7 A2 Interpretation A2.1 Meaning of words and phrases For the purposes of interpreting the words and phrases used in this policy, the following words and phrases (which appear in bold when used in this policy) have the corresponding meanings: Act means the Reserve Bank of New Zealand Act 1989 annual means a period of 12 months, commencing on the day after the day on which the relevant obligation was last performed, and annually has a corresponding meaning bank means a person registered under Part 5 of the Act basic banking services means the key retail and business services that bank customers typically rely on for transactions and economic life, including the following services: (iii) (iv) (v) New Zealand dollar transactional or similar accounts used by individuals and businesses for their transactional needs, including Automatic Teller Machine (ATM) services, and the ability of customers to access their account through at least two other of the most commonly used channels; and New Zealand dollar savings accounts and deposits accounts, including term deposit accounts, provided to customers as a store of value; and New Zealand dollar credit services to customers, including credit cards, overdraft and revolving credit facilities, secured and unsecured lending, and home loan facilities, including pre-approvals; and payment clearing and settlement services, including credit card merchant acquiring services and agency arrangements; and account activity reporting for the accounts, services, and products required in respect of basic banking services held by customers; and that, if disrupted or suddenly discontinued, could be reasonably expected to have a material negative impact on a significant number of third parties that rely on such services; or lead to contagion effects, including significant adverse effects on market confidence Guidance: The definition of basic banking services makes no distinction between customer types and so, for the purposes of this definition, there is no difference between consumer, small- tomedium business, or institutional customers. Guidance: For all products offered to customers that are not basic banking services, a bank must be able to close out and manage the wind down of those products on a standalone basis. The level of back-up necessary to meet this requirement will be agreed with the Reserve Bank and may be less than the robust back-up capability outlined in Part B2. This will need to be covered off in a bank s separation plan. See Part B5.

8 8 banking group means the group defined in the bank s conditions of registration becoming effective means the time at which outsourcing arrangement becomes enforceable by both the bank and the outsourcing arrangement provider business continuity programme/disaster recovery capability (BCP/DR capability) means a business continuity programme and disaster recovery capability that is provided for by the outsourcing arrangement provider; and appropriate and adequate for the purposes of ensuring the continuation of the relevant outsourcing arrangement BS11 means this outsourcing policy business day means a day of the week other than a Saturday, a Sunday, the Sovereign's birthday, Labour Day, Good Friday, Easter Monday, Waitangi Day, Anzac Day, Christmas Day, Boxing Day, New Year s Day, and 2 January; and a day that is specified in any of the following paragraphs as not being a business day: (iii) if Waitangi Day or Anzac Day falls on a Saturday or a Sunday, the following Monday is not a business day. if Christmas Day or New Year s Day falls on a Friday, the following Monday is not a business day. if Christmas Day or New Year s Day falls on a Saturday or a Sunday, the following Monday and Tuesday are not business days. commencement date means the date on which a bank s conditions of registration for the revision of BS11 issued in September 2017 first take effect compendium means a formal and centralised record of all outsourcing arrangements of a bank that complies with the requirements of Part B4 day of failure means the day on which either a bank (iii) becomes subject to statutory management; or is no longer a subsidiary of its parent; or is given a direction under the Act in relation to an outcome under section B1.1(3); or a disruption of an outsourcing arrangement of a bank occurs disruption of an outsourcing arrangement means a situation where, because of the interruption, suspension, or unavailability of an outsourcing arrangement, the bank is, or will be, unable to meet the outcomes of section B1.1(3) existing outsourcing arrangement means an outsourcing arrangement that was entered into by a bank before the commencement date, and includes an in-progress arrangement foreign-owned banking group: means an entity that is incorporated, formed, or established in a jurisdiction other than New Zealand, regardless of whether it (A) (B) has a primary place of business in New Zealand; or carries on business in New Zealand; and carries on banking business with authorisation, licence, or similar

9 9 permission from a banking supervisory authority having jurisdiction in that entity s country of incorporation; and all subsidiaries of that entity function includes a system independent third party means a third party that is not a subsidiary, a parent, or a related party in-progress arrangement means an outsourcing arrangement, in respect of which, at the commencement date, (iii) the bank s internal supplier risk acceptance and approval processes have commenced; and Reserve Bank non-objection in relation to the proposed outsourcing arrangement has been sought by the bank (if applicable); and a draft contract or statement of work is already under negotiation with the outsourcing arrangement provider or its external counsel; and that will be finalised no later than 3 months after the commencement date large bank means a bank that is incorporated as a company in New Zealand; and whose net liabilities, as specified in the bank s latest disclosure statement, exceed $10 billion legal ability to control and execute a service or function means a bank s ability to invoke statutory, contractual, or other rights, to ensure that the relevant service or function continues to be provided legal and practical control means both legal ability to control and execute a service or function and practical ability to control and execute a service or function list of pre-approved services and functions means the list described in Part C1 net liabilities means the total liabilities of the banking group; but does not include any amounts that the banking group owes to related parties other related party means a related party that is not a subsidiary outsourcing means a bank s use, now and in the future, of a third party (either a related party within the banking group or third party that is external to the banking group) to perform services or functions on a regular or continuing basis that could be undertaken by the bank; but does not include a bank s use of any services or functions on the white list outsourcing arrangement means a contractual arrangement for outsourcing outsourcing arrangement provider means the service or function provider under an outsourcing arrangement parallel rights means step-in rights that allow the bank to enforce its rights under the outsourcing arrangement in question if the bank were to no longer be a subsidiary of its parent; or on the failure of the other related party; or

10 a separate contract that 10 provides for the continuation of the outsourcing arrangement in question; and comes into force (A) (B) if the bank were to no longer be a subsidiary of its parent; or on the failure of the other related party parent means a person that is a holding company of the bank person includes a corporation sole, a body corporate, and an unincorporated body practical ability to control and execute a service or function means a bank s ability to secure continued provision of the outsourcing arrangement within the timeframes set out in this document Guidance: Practical ability to control and execute a service or function depends heavily on the availability and responsiveness of personnel with the technical and business knowledge needed to control and execute the function, as well as physical access to and control of the required systems and data. In meeting the timeframes, the bank must ensure that it takes account of any delays that it may face in enforcing its legal rights. prescribed contractual terms means the contractual terms specified in section B2.9 related party means a person that directly or indirectly controls the management of the bank; or a person that has direct or indirect qualifying interest in 20% or more of the voting or non-voting securities issued by the bank; or a person that is directly or indirectly controlled by that bank; or (d) a person in which that bank has a direct or indirect qualifying interest in 20% or more of the voting or non-voting securities issued by that person; or (e) (f) a person (person A) to whom both the person in question (person B) and the bank are related parties; or any other person, where a parent of the bank has a direct or indirect interest in 20% of the voting securities of that person; or controls the management of that person: subsidiary for the purposes of BS11 means a subsidiary within the meaning given by section 2(1) of the Act; and is incorporated in New Zealand. thereafter means an indefinite period third party means a person that is not the bank time-critical obligation means clearing, settlement, and any other obligation of a bank that is relevant to it meeting the requirements of BS11; and includes an obligation of a bank to ensure that payments are made to critical service or function providers Guidance: Critical service providers will be agreed with the Reserve Bank on a bank by bank basis. white list means the list described in Part C2

11 11 Part B: General requirements on banks B1 Outcomes B1.1 Obligation of individual bank to achieve outcomes (1) A bank meets the objectives of this policy if the bank is able to achieve all of the outcomes described in subsection (3). (2) However, subsection (1) is subject to section B1.2. (3) The outcomes are that the bank must (d) continue to meet its daily clearing, settlement, and other time-critical obligations, both before the start of the first business day after the day of failure and thereafter; and monitor and manage its financial positions, including credit, liquidity, and market risk positions, both on the start of the first business day after the day of failure and thereafter; and make available the systems and financial data necessary for the statutory manager and Reserve Bank to have available a range of options for managing the failed bank, both before the start of the business day after the day of failure and thereafter; and provide basic banking services to existing customers including, but not limited to, liquidity (both access to deposits and to credit lines as defined in basic banking services) and account activity reporting, both on the start of the first business day after the day of failure and thereafter. B1.2 Obligation of bank that is part of a foreign-owned banking group to achieve outcomes A bank that is part of a foreign-owned banking group meets the objectives of this policy if, in the event of separation from its parent, it is able to achieve the outcomes described in section B1.1(3) as a stand-alone entity. B2 Risk mitigation B2.1 Outsourcing arrangements to include risk mitigation provisions (1) An outsourcing arrangement must have the relevant risk mitigation requirements in place at all times, as set out in this subpart, according to the type of outsourcing arrangement. (2) The types of outsourcing arrangement are as follows: (d) (e) (f) an outsourcing arrangement with an independent third party (see section B2.2): an outsourcing arrangement with a subsidiary (see section B2.3): an outsourcing arrangement made through a subsidiary (see section B2.4); an outsourcing arrangement with an other related party (see section B2.5); an outsourcing arrangement with an independent third party that is made through an other related party (see section B2.6); an outsourcing arrangement that is not specifically dealt with in any of sections B2.2 to B2.6 (see section B2.7). (3) If the outsourcing arrangement is with an other related party, the bank must also have robust back-up capability in place or, subject to the bank having obtained nonobjection from the Reserve Bank, have made alternative arrangements (see section B2.8).

12 12 (4) If the outsourcing arrangement is made with an independent third party through an other related party, the bank may seek the Reserve Bank s agreement, by way of a notice of non-objection, to substitute the parallel rights component of the prescribed contractual terms (see section B2.9) with robust back-up capability or alternative arrangements (see sections B2.6(3) B2.8). B2.2 Outsourcing arrangement with independent third party (1) This section sets out the risk mitigation requirements that a bank must have in place in relation to an outsourcing arrangement with an independent third party. (2) To meet the risk mitigation requirements for a direct outsourcing arrangement with an independent third party, the bank must ensure that the BCP/DR capability of the independent third party is evidenced as being in place; and the prescribed contractual terms are included in the outsourcing arrangement; and the outsourcing arrangement is entered onto the bank s compendium. Guidance: Parallel rights are not required for an outsourcing arrangement with an independent third party. B2.3 Outsourcing arrangement with subsidiary (1) This section sets out the risk mitigation requirements that a bank must have in place in relation to an outsourcing arrangement with a subsidiary. (2) To meet the risk mitigation requirements for arrangements with a subsidiary, a bank must ensure that the BCP/DR capability of the subsidiary is evidenced as being in place; and the prescribed contractual terms, other than the parallel rights, are included in the outsourcing arrangement; and the outsourcing arrangement is entered onto the bank s compendium. B2.4 Outsourcing arrangement made through subsidiary (1) This section sets out the risk mitigation requirements that a bank must have in place in relation to an outsourcing arrangement with a subsidiary that outsources the relevant service or function to an independent third party. (2) To meet the risk mitigation requirements for arrangements with a subsidiary, a bank must ensure that the BCP/DR capability of the independent third party is evidenced as being in place; and the prescribed contractual terms, other than the parallel rights, are included in the outsourcing arrangement; and the outsourcing arrangement is entered onto the bank s compendium. B2.5 Outsourcing arrangement with other related party (1) This section sets out the risk mitigation requirements that a bank must have in place in relation to an outsourcing arrangement with an other related party.

13 13 (2) To meet the risk mitigation requirements for an outsourcing arrangement with an other related party, the bank must ensure that (d) the BCP/DR capability of the other related party is evidenced as being in place; and the prescribed contractual terms are included in the outsourcing arrangement; and it has in place either a robust back-up capability (see section B2.8(1) (6)); or alternative arrangements (see section B2.8(7) (10)); and the outsourcing arrangement is entered onto the bank s compendium. (3) However, despite subsection (2), a bank is not required to have in place a robust back-up capability or to have made alternative arrangements if the bank is not part of a foreign-owned banking group; and the outsourcing arrangement is with a related party; and that related party is incorporated in New Zealand. B2.6 Outsourcing arrangement made through parent or other related party (1) This section sets out the risk mitigation requirements that a bank must have in place in relation to an outsourcing arrangement with the parent or an other related party that outsources the relevant service or function to an independent third party. (2) To meet the risk mitigation requirements for an outsourcing arrangement made with an independent third party through a parent or an other related party, the bank must ensure that the BCP/DR capability of the independent third party is evidenced as being in place; and the prescribed contractual terms are included in the outsourcing arrangement; and the outsourcing arrangement is entered onto the bank s compendium. (3) However, despite subsection (2), a bank is not required to have the parallel rights component of the prescribed contractual terms in place if either the bank has a notice of non-objection from the Reserve Bank to substitute those parallel rights with either a robust back-up (see section B2.8(1) to (6)); or alternative arrangements (see section B2.8(7) to (10)). the bank is not part of a foreign-owned banking group and the outsourcing arrangement is with a related party; and that related party is incorporated in New Zealand. B2.7 Other outsourcing arrangement (1) This section applies to any outsourcing arrangement not provided for in any of sections B2.2 to B2.6. (2) If a bank proposes to enter into an outsourcing arrangement not provided for in any of sections B2.2 to B2.6, it may apply to the Reserve Bank for a notice of nonobjection to that arrangement.

14 14 (3) An application for non-objection must be made to the Reserve Bank in the form available on the Reserve Bank s internet site. (4) To avoid doubt, a bank may not enter into an outsourcing arrangement not provided for in any of sections B2.2 to B2.6 unless it has first obtained a notice of non-objection from the Reserve Bank. B2.8 Outsourcing arrangement with other related party: robust back-up capability and alternative arrangements (1) This section sets out the robust back-up requirements that a bank must have in place if the bank has an outsourcing arrangement with an other related party, and the requirements applying to a bank that seeks to make alternative arrangements to the robust back-up requirements. (2) The requirements in subsections (3) to (6) do not apply if the bank has a notice of non-objection to enter into alternative arrangements (see subsections (7) to (10)). (3) A bank must obtain non-objection from the Reserve Bank before the bank enters into a robust back-up arrangement. (4) An application for non-objection must be made to the Reserve Bank in the form available on the Reserve Bank s internet site. (5) To meet the robust back-up requirements, the bank must ensure that (d) (e) there is no possibility of permanently losing transactions; and all disrupted transactions must be processed within 48 hours of the failure or disruption of the outsourcing arrangement; and the switch over from the outsourced arrangement to its robust back-up arrangement must be delivered on the day of failure for functions related to outcomes described in section B1.1(3) and (the robust back-up arrangement must be running no later than 6 hours after the time at which the bank is required to switch over); and before 9:00 am on the business day after the day of failure for functions related to outcomes described in section B1.1(3) and (d); and the back-up arrangement must be sustainable; and Guidance: The back-up arrangement will be considered sustainable if it could be equally substituted for the outsourcing arrangement on an ongoing and fully automated basis, to deliver the outsourced service or function with minimal impact and disruptions to both the bank s customers and the bank s own business operation. testing of end-to-end functionalities for the back-up arrangement is conducted (A) (B) on an annual basis; and in an environment that replicates the functional, operational, and infrastructure capabilities of the required back-up service or function; and enables the bank to provide reasonable assurance that the back-up arrangement will be available, and work, as intended; and Guidance: This testing must be done to ensure that the back-up arrangement will be available and work as intended.

15 (f) (g) (h) 15 changes made to the live environment must also be made in the back-up environment; and external review of the back-up arrangement must be conducted, to ensure the arrangement remains robust, it has annually, during the five-year transitional period; and at least every three years after that period has expired; and direct ownership of the back-up system; or legal and practical control over all aspects of the back-up system. Guidance: This means that the backup arrangement cannot be provided by a parent of the bank or a related party of the parent. However, a bank can apply to the Reserve Bank to have its backup arrangement provided by a subsidiary. This requirement does not mean that the system must be located in New Zealand, but requires that the bank should have the legal and practical control over back-up system: that is, that they own the system (or have a direct relationship with the third party provider for that system) and the data that is required to use it. (6) The timeframes relating to the back-up capability requirement do not affect the timeframes for a bank s conditions of registration relating to BS17: Open Bank Resolution Pre-positioning Requirements Policy (or other applicable requirements under other conditions of registration) and a bank must ensure that it can meet the requirements of these as well as the BS11 requirements. Guidance: The back-up capability timeframes are designed to ensure that a bank will be able to reopen at 9am the day after being placed into statutory management. It is important for banks to recognise that these timeframes do not affect a bank s other obligations under its conditions of registration. (7) Despite subsections (3) (6) if a bank has an outsourcing arrangement with an other related party, the bank may apply to the Reserve Bank for a non-objection to make alternative arrangements to the robust back-up capability requirements. (8) A bank must obtain non-objection from the Reserve Bank before the bank enters into an alternative arrangement. (9) An application for non-objection must be made to the Reserve Bank in the form available on the Reserve Bank s internet site. (10) In considering whether or not to grant non-objection to a bank to make alternative arrangements, the Reserve Bank s considerations will include, but will not be limited by, the following matters (d) (e) whether the bank has legal and practical control over the outsourcing arrangement provider and the outsourcing arrangement; and whether the parent, an other related party, or any overseas authorities may be able to frustrate the outsourcing arrangement, or control or direct the outsourcing arrangement provider; and the relationship between the bank and the outsourcing arrangement provider; and what functions or activities the outsourcing arrangement provider will be undertaking on behalf of the bank; and whether the outsourcing arrangement provider will also be providing services or functions to any related parties.

16 B2.9 Prescribed contractual terms 16 (1) If a bank has entered into an outsourcing arrangement, the bank must ensure that the outsourcing arrangement contains the prescribed contractual terms. (2) The prescribed contractual terms are as follows: there must be a contractual provision that ensures continuing access, on arms-length commercial terms, to the relevant services and functions if the bank enters statutory management; and Guidance: For the purposes of this requirement, arms-length commercial terms includes a term that requires the bank to continue to pay for the service or function under the existing contract with the third party. there must be a contractual provision that gives the Reserve Bank the ability to access documentation, and other information, that relates to the outsourcing arrangement. Guidance: The Reserve Bank only expects that third party providers will be contractually required to provide access to documentation and information about a relevant outsourcing arrangement, when such documentation and information belongs to, or is accessible to, the third party itself. (3) If a bank has entered into an outsourcing arrangement that is made through a parent or an other related party, the prescribed contractual terms also include a term that enables the bank to ensure that it has parallel rights in relation to that outsourcing arrangement. Guidance: This requirement is designed to ensure that the bank has continuing access to the services or functions if the bank is separated from its parent or the wider banking group. Further contractual terms the Reserve Bank would expect, but does not require, to see included in a robust outsourcing arrangement include terms relating to matters such as- (d) (e) (f) (g) (h) (j) (k) (l) (m) (n) (o) (p) the scope of the arrangement and the services and functions to be supplied: the commencement and end dates: escrow arrangements: review provisions: pricing and fee structure: service and function levels and performance requirements: the form in which the data is to be kept and clear provisions identifying ownership and control of data: reporting requirements, including content and frequency of reporting: audit and monitoring processes; business continuity management around how the service or function provider will deal with a failure of the service or function it is providing: confidentiality privacy and security of arrangements: default arrangements and termination provisions: dispute resolution arrangements: liability and indemnity; sub-contracting: insurance.

17 B3 17 Non-objection from Reserve Bank B3.1 Non-objection required for certain outsourcing arrangements (1) A bank must obtain non-objection from the Reserve Bank before the bank enters into an outsourcing arrangement. (2) However, despite subsection (1), non-objection is not required if the proposed outsourcing arrangement is (d) an arrangement of the kind described in section B3.4; or on the List of pre-approved services and functions; or on the White list; or contracted, or proposed to be contracted, directly between the bank and an independent third party. Guidance: Where a bank proposes to outsource a service or function that is on the List of Pre-Approved Services and Functions or the White list, (the services and functions on those lists are not subject to the requirement for non-objection from the Reserve Bank), a Bank must otherwise comply with all other relevant provisions of BS11, and all other relevant conditions of registration, when entering into the outsourcing arrangement. For further information on these documents, see Part C. B3.2 Application for non-objection (1) A bank must obtain non-objection from the Reserve Bank before the bank enters into an outsourcing arrangement that is not described in section B3.1(2). (2) An application for non-objection must be made to the Reserve Bank in the form available on the Reserve Bank s internet site. Guidance: The application will contain fairly high-level information on the proposed outsourcing arrangement. It is anticipated that, in combination with the extended white list, the Reserve Bank will be in a position to consider the majority of outsourcing applications under this application. It would only be for more complex arrangements that the Reserve Bank anticipates the need for a more comprehensive application. (3) The application must demonstrate that, in assessing the options for outsourcing a service or function, the bank has considered, and responded appropriately to, all the matters outlined in the application form. B3.3 Consideration of application (1) On receiving an application for non-objection to an outsourcing arrangement from a bank, the Reserve Bank will do one of the following things: (d) it may issue the bank with a notice of non-objection to the outsourcing arrangement; or it may require the bank to make modifications to the proposed outsourcing arrangement before entering into it; or it may request the bank to provide more information; or it may decline the application. Guidance: The Reserve Bank will endeavour to provide the outcome of the application to the bank within 20 working days. (2) Subsections (3) to (5) set out further detail on how, having considered an application, the Reserve Bank will respond to an application if it does not issue the non-objection in accordance with subsection (1).

18 18 (3) If the Reserve Bank considers that modifications to the proposed outsourcing arrangement should be made, it may require the bank to make such modifications before the bank enters into the proposed outsourcing arrangement. Guidance: In this case, the Reserve Bank s non-objection may be issued subject to the bank making the required modifications, or the Reserve Bank may defer issuing its non-objection until such time as it is satisfied that the bank has made those modifications. (4) If the Reserve Bank considers that more information is required, it may request that the bank provides further, specified, information and, in that case, the application will not be considered further until the bank provides the requested information; and on receipt of that information by the Reserve Bank, the application will be treated as a new request, and the process outlined in subsection (1) will be re-applied. (5) The Reserve Bank may decline the application if it considers that it is not possible for the proposed outsourcing arrangement to comply with BS11; or despite requests for the bank to make modifications or provide further information, the bank has failed, within a reasonable time, to do so to the satisfaction of the Reserve Bank; the Reserve Bank, for any other reason, reasonably considers that it would not be appropriate to issue a notice of non-objection. (6) To avoid doubt, regardless of the issue by the Reserve Bank of a notice of nonobjection, it is the bank s responsibility to ensure the outsourcing arrangement in question is, and remains, compliant with BS11. Guidance: A notice of non-objection from the Reserve Bank to an outsourcing arrangement is made on the basis of information a bank provides to the Reserve Bank. A notice of non-objection does not constitute a safe-harbour. It is the bank s responsibility to ensure an outsourcing arrangement is compliant with the policy and continues to be so. B3.4 Existing outsourcing arrangements and in-progress outsourcing arrangements (1) A bank does not need to seek Reserve Bank non-objection in relation to an outsourcing arrangement that is an existing outsourcing arrangement or an inprogress outsourcing arrangement. (2) However, the bank must ensure that all outsourcing arrangements, including those described in subsection (1), are included in the bank s transition path; and Guidance: The transition path refers to the steps that a bank must follow to ensure that it achieves full compliance with BS11 within the 5-year transition period. The relevant requirements are set out in Part D. comply with BS11 no later than 5 years after the commencement date.

19 B4 Compendium 19 B4.1 Requirement for, and purpose of, compendium (1) The bank must have a compendium. (2) The purpose of the compendium is to enable the Reserve Bank and a statutory manager to understand what services and functions have been outsourced by a bank. (3) This information must be readily accessible as some outsourcing arrangements may relate to time-critical obligations. (4) This section is subject to section B4.5, which allows a bank 2 years from the commencement date to meet its obligations in relation to its compendium. B4.2 Content and form of compendium (1) A compendium must include the following information: (d) (e) the legal name, physical address, and address for service, of the entity providing the outsourced arrangements; and the total value of the outsourcing arrangement, including both the upfront costs and the on-going expenses; and the expiry date, and any renewal date, of the outsourcing arrangement; and the outsourcing arrangements in place for the termination of the outsourcing arrangement (see section B2.6); and an overview of the service or function that has been outsourced. (2) The compendium must be kept in electronic form, and in a format that ensures that it is accessible to the Reserve Bank when requested under section B4.4. Guidance: Both forms of the compendium should contain identical content. One of the reasons for requiring electronic format is to enable the compendium to be sent to the Reserve Bank in that format, if required under section B4.4. B4.3 Bank must maintain, and annually review, compendium (1) The bank must ensure that the compendium (d) is a key accountability document, embedded in the bank s compliance system; and is kept up to date; and is updated within 20 working days of any new outsourcing arrangement becoming effective, to take account of that new outsourcing arrangement; and Guidance: In the case of a new outsourcing arrangement, the required information will be as required under section B4.2. Further, the other requirements in BS11 relating to outsourcing arrangement will apply equally to the new arrangement. forms part of the oversight and governance reviews undertaken by the board and senior management of the bank. (2) In addition to requirements of subsection (1), the bank must ensure that the compendium is reviewed regularly, and at least annually; and the review is conducted by one of the following, as appropriate: the bank s own internal audit function; or

20 (iii) 20 an external auditor of the bank; or the independent external reviewer (see Part D). B4.4 Bank must provide compendium to Reserve Bank The bank must provide the compendium to the Reserve Bank, on request; and in the format requested (see section B4.2(2)). Guidance: The Reserve Bank will likely ask for a copy of a bank s compendium at least once a year as part of normal supervisory practice. Outside of this annual request the Reserve Bank will likely only ask for a copy of a bank s compendium in special circumstances. B4.5 Transitional provision (1) A bank may, but is not required to, have a compendium on the commencement date. (2) However, the bank must ensure that it has a compendium that meets the requirements of this Part within 2 years of the commencement date. (3) The bank must incorporate the requirement for a compendium into its transition path for compliance with the September 2017 revision of BS11. B5 Separation plan B5.1 Requirement for, and purpose of, separation plan (1) Subject to subsections (2) and (3) a bank must have a separation plan. (2) The purpose of a separation plan is to enable the bank to provide for the steps it would take to ensure that outsourcing arrangements in relation to the bank s services and functions would continue to be provided on the day of failure and thereafter. Guidance: Specifically, the objective of the separation plan should be that the bank continues to meet the outcomes of BS11. (3) The requirement for a separation plan does not apply if the bank is subject to BS11, but it is not a member of a foreign-owned banking group. (4) A bank is not required to have a separation plan until 6 months after the commencement date, at which time the plan must be in draft form: the bank must have a separation plan that is fully compliant with this policy within 5 years of the commencement date. B5.2 Content and form of separation plan (1) A separation plan must include the following information: a description of the processes the bank would undertake to operate services and functions in respect of outsourcing arrangements that were previously provided by, or through, an other related party in the event it is subject to the appointment of a statutory manager; or otherwise separated from the foreign-owned banking group; and

21 (d) (e) 21 details of the following matters, from the day of being subject to statutory management or separated from its foreign-owned banking group and, if necessary, thereafter: (iii) (iv) (v) how the bank will meet the outcomes of BS11; and how the bank will ensure parallel rights for the bank are available for functions outsourced through the parent or an other related party; and the robust back-up arrangements for services and functions that are provided by or through an other related party; and how the back-up capability will be activated, including the timeframes for doing so; and the processes that the bank will implement to deliver the outcomes described in section B1.1(3), from the point of separation from its parent to the point the outcomes are attained on a standalone basis. details of which staff positions are responsible for taking these actions, including a clear chain of command and a communications plan; and the relevant timeframes under which the separation and transition will be undertaken; and the technology and other resource needed by the bank to implement its separation plan. (2) In preparing its separation plan, the bank must prepare for an abrupt loss of access to the services and functions provided by the parent or an other related party both on the day of failure and thereafter. Guidance: While a bank may have contractual arrangements in place for its parent and an other related party to provide transition services and functions in the event of separation, these contracts should not be relied upon for the purposes of the separation plan. However, banks may continue to rely on contractual arrangements that are in substance unaffected by the separation. The Reserve Bank may issue additional guidance to banks on how to produce separation plans. (3) The bank must include the separation plan within the scope of the external reviews of the bank s compliance with the outsourcing policy, as set out in Part D. B5.3 Non-objection required for separation plan (1) A bank must obtain non-objection from the Reserve Bank before the bank finalises its separation plan. B5.4 Application for non-objection (1) A bank must apply to the Reserve Bank for non-objection. (2) An application for non-objection must be made to the Reserve Bank. (3) A bank may only submit a draft separation plan for Reserve Bank non-objection after it has been approved by the senior management and Board of the bank. B5.5 Consideration of application (1) On receiving an application for non-objection to a separation plan from a bank, the Reserve Bank will do one of the following things: it may issue the bank with a notice of non-objection to the separation plan; or it may require the bank to make modifications to the proposed separation plan before giving notice of non-objection; or

22 (d) it may request the bank to provide more information; or 22 it may decline the proposed separation plan. (2) The process that the Reserve Bank will follow in responding to an application if it does not issue the non-objection in accordance with subsection (1) is as set out in section B3.3(3) to (5), with references to the outsourcing arrangement being read as references to the separation plan. (3) To avoid doubt, regardless of the issue by the Reserve Bank of a notice of nonobjection, it is the bank s responsibility to ensure the separation plan is, and remains, compliant with BS11. Guidance: A notice of non-objection from the Reserve Bank to a separation plan is made on the basis of information a bank provides to the Reserve Bank. A notice of nonobjection does not constitute a safe-harbour. It is the bank s responsibility to ensure a separation plan is compliant with the policy and continues to be so. B5.6 Bank to test separation plan annually (1) The bank must ensure that the separation plan is tested regularly, and at least annually. (2) The bank must, after completing the separation plan test, report the results of the test to the Board of the bank at the next Board meeting; and to the Reserve Bank within 8 weeks. (3) However, despite subsection (2), if the bank identifies any impediments to the separation process during the test it must advise the Reserve Bank, within 24 hours of the impediment being identified, of the fact that an impediment has been identified and, if possible, the cause of that impediment; and if the cause of the impediment cannot reasonably be identified within the 24 hours specified in paragraph, advise the Reserve Bank of the cause as soon as reasonably practicable, but not later than two weeks of the impediment being identified; and as soon as reasonably practicable, and no later than two weeks after the impediment was identified, provide the Reserve Bank with details of how the bank proposes to remedy the impediment. B5.7 Reporting of changes to, and review of, separation plan (1) A bank must report all changes to its separation plan to the Reserve Bank. (2) If the Reserve Bank considers a change reported to it under subsection (1) to be material, the bank will be required to make modifications to its separation plan and submit a further application in accordance with section B5.4, for consideration by the Reserve Bank. (3) The Reserve Bank may review a bank s separation plan at any time. (4) Following a review of a bank s separation plan, the Reserve Bank may require the bank to make modifications to that plan, in which case the bank must submit a further application, in accordance with section B5.4, for consideration by the Reserve Bank.

23 Part C: Reserve Bank lists C1 Pre-approved services and functions C1.1 Reserve Bank may maintain list of pre-approved services and functions (1) The Reserve Bank may maintain a list of services and functions 23 that, if carried out for the bank by a third party, constitute outsourcing arrangements; but which do not require Reserve Bank non-objection. Guidance: The effect of this provision is that the bank may enter into such arrangements without the need to obtain non-objection under Part B3. (2) If the Reserve Bank chooses to maintain such a list, it will be referred to as the List of Pre-approved Services and Functions, and will be publicly available on the Reserve Bank s internet site. (3) A bank that outsources a service or function on the List of Pre-approved Services and Functions must, in relation to that outsourcing arrangement, still comply with all other requirements of BS11. C1.2 Amendments to List of Pre-approved Services and Functions (1) A bank may apply in writing to the Reserve Bank to have new services or functions added to the List of Pre-Approved Services and Functions. Guidance: The application form for this purpose is available on the Reserve Bank s internet site. (2) The Reserve Bank may also at its discretion make the following changes to the List of Pre-Approved Services and Functions add a new service or function; or remove an existing service or function; or amend the description of an existing service or function. (3) However, before removing, or amending the description of, an existing service or function, the Reserve Bank will consult with large banks. (4) Following any change made in accordance with this section, the Reserve Bank will publish a revised List of Pre-Approved Services and Functions on its internet site. C2 Exempt services and functions C2.1 Reserve Bank may maintain list of exempt services and functions (1) The Reserve Bank may maintain a list of services and functions that, if carried out by a third party, constitute outsourcing arrangements; but that are not relevant to BS11. Guidance: The effect of this provision is that the bank may enter into such arrangements without the need to obtain non-objection under Part B3. (2) If the Reserve Bank chooses to maintain such a list, it will be referred to as the White List, and will be publicly available on the Reserve Bank s internet site.